Risk information determination method and device, storage medium and electronic equipment

Abstract

The embodiment of the invention provides a risk information determination method and device, a storage medium and electronic device.The method comprises the steps that target firmware of target equipment is obtained, and the target firmware is decompressed according to the type of the target firmware to obtain a file of the target firmware; performing reverse operation on the file to obtain an operation process and an operation result corresponding to the reverse operation; determining first risk information of the target firmware according to the operation result, and inputting the file, the operation process and the operation result into a target model, so that the target model outputs second risk information of the target firmware based on the file, the operation process and the operation result; and determining target risk information of the target firmware according to the first risk information and the second risk information.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, in particular to a risk information determination method and device, a storage medium and an electronic device. BACKGROUND

[0002] With the rapid development of Internet of Things (IoT) technology, the concept of "Internet of Everything" is gradually becoming a reality, giving birth to diversified application scenarios from smart home to industrial automation, from health monitoring to smart city. However, the prosperity of the Internet of Things is accompanied by complex challenges in firmware security analysis. The firmware of IoT devices, as a bridge connecting hardware and software, carries the core functions and security controls of the device, and its form is highly heterogeneous due to the diversity of device types, architectures, systems and supply chains.

[0003] The highly heterogeneous IoT device firmware environment poses unprecedented challenges to security analysis and vulnerability mining. In related technologies, security analysis of firmware is usually performed by automated analysis scripts. Due to the diversity of IoT devices and the complexity of firmware types, automated analysis scripts often need to be frequently updated and customized to adapt to various firmware analysis capabilities, thereby leading to low efficiency in security analysis of firmware.

[0004] To address the problem of low efficiency in security analysis of firmware in related technologies, no effective solutions have been proposed so far.

[0005] Therefore, it is necessary to improve the related technologies to overcome the defects in the related technologies. SUMMARY

[0006] Embodiments of the present application provide a risk information determination method and device, a storage medium and an electronic device to at least solve the problem of low efficiency in security analysis of firmware in related technologies.

[0007] According to an embodiment of the present application, a risk information determination method is provided, comprising: obtaining a target firmware of a target device, and decompressing the target firmware according to a type of the target firmware to obtain a file of the target firmware; performing a reverse operation on the file to obtain an operation process and an operation result corresponding to the reverse operation; determining first risk information of the target firmware according to the operation result, and inputting the file, the operation process and the operation result into a target model to make the target model output second risk information of the target firmware based on the file, the operation process and the operation result; and determining target risk information of the target firmware according to the first risk information and the second risk information.

[0008] Further, the file of the target firmware is obtained according to the type of the target firmware, including: determining whether there is a decompression failure problem in the decompression process; in the case that there is a decompression failure problem, inputting the decompression failure problem into the target model, so that the target model outputs a repair method corresponding to the decompression failure problem; adjusting the target firmware based on the repair method, and decompressing the adjusted target firmware to obtain the file of the target firmware.

[0009] Further, after the file and the operation result are input into the target model, and the target model outputs the risk information of the firmware based on the file and the operation result, the method further includes: in the case that the risk information indicates that the firmware has a risk, determining whether to adjust the parameter information of the firmware based on the target model; in the case that it is determined to adjust the parameter information of the firmware based on the target model, executing a first operation strategy on the firmware; in the case that it is determined not to adjust the parameter information of the firmware based on the target model, executing a second operation strategy on the firmware.

[0010] Further, the first operation strategy on the firmware includes: adjusting the parameter information of the firmware based on the target model, obtaining the firmware after the adjustment of the parameter information and the file system after the adjustment of the parameters; loading the file system after the adjustment of the parameters to the simulation unit to generate a running environment of the firmware; verifying the firmware after the adjustment of the parameter information based on the target verification program in the running environment to determine whether the firmware after the adjustment of the parameter information has a risk.

[0011] Further, the adjustment of the parameter information of the firmware based on the target model to obtain the firmware after the adjustment of the parameter information and the file system after the adjustment of the parameters includes: determining the business logic of the risk point of the firmware; controlling the target model to determine the repair method of the risk point according to the business logic of the risk point; adjusting the parameter information of the firmware according to the repair method to obtain the firmware after the adjustment of the parameter information and the file system after the adjustment of the parameters.

[0012] Further, the second operation strategy on the firmware includes: obtaining the file system of the firmware, and loading the file system to the simulation unit to generate a running environment of the firmware, wherein the file system includes a file; verifying the firmware based on the target verification program in the running environment to determine whether the firmware has a risk again.

[0013] Further, before the determination of whether to adjust the parameter information of the firmware based on the target model, the method further includes: determining the risk type and the business logic of the firmware, and generating a verification program according to the risk type and the business logic; inputting the verification program into the target model to verify the verification program by the target model; in the case that the target model determines that the verification program has an exception, repairing the verification program by the target model to obtain a target verification program.

[0014] According to an aspect of the present application, a risk information determination apparatus is provided, comprising: a decompression module configured to obtain target firmware of a target device, and decompress the target firmware according to a type of the target firmware to obtain a file of the target firmware; an operation module configured to perform reverse operations on the file to obtain an operation process and an operation result corresponding to the reverse operations; a first determination module configured to determine first risk information of the target firmware according to the operation result, and input the file, the operation process and the operation result into a target model to enable the target model to output second risk information of the target firmware based on the file, the operation process and the operation result; and a second determination module configured to determine target risk information of the target firmware according to the first risk information and the second risk information.

[0015] According to another embodiment of the present application, a computer readable storage medium is further provided, and the computer readable storage medium stores a computer program, wherein the computer program is configured to execute the steps in any of the method embodiments when running.

[0016] According to another embodiment of the present application, an electronic device is further provided, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the computer program to perform the steps in any of the method embodiments.

[0017] According to another embodiment of the present application, a computer program product is further provided, comprising a computer program, and the computer program is configured to perform the steps in any of the method embodiments when executed by a processor.

[0018] According to the present application, the target firmware of the target device is obtained, and the target firmware is decompressed according to the type of the target firmware to obtain the file of the target firmware; the reverse operations are performed on the file to obtain the operation process and the operation result corresponding to the reverse operations; the first risk information of the target firmware is determined according to the operation result, and the file, the operation process and the operation result are input into the target model to enable the target model to output the second risk information of the target firmware based on the file, the operation process and the operation result; and the target risk information of the target firmware is determined according to the first risk information and the second risk information. In the embodiments of the present application, the intelligent decision and dynamic adjustment of the large model are combined in each link of the firmware security analysis, which greatly improves the automation degree and vulnerability identification capability of the firmware security analysis, reduces the dependence on professional security analysis personnel, and improves the analysis efficiency. Therefore, the problem of low efficiency of the security analysis on the firmware can be solved. BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the present application.

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0021] Figure 1 This is a hardware structure block diagram of a computer device for a method of determining risk information according to an embodiment of this application;

[0022] Figure 2 This is a flowchart (a) of a method for determining risk information according to an embodiment of this application;

[0023] Figure 3 This is a structural block diagram of the risk information determination system according to an embodiment of this application;

[0024] Figure 4 This is a flowchart (II) of a method for determining risk information according to an embodiment of this application;

[0025] Figure 5 This is a structural block diagram of a risk information determination device according to an embodiment of this application. Detailed Implementation

[0026] The embodiments of this application will be described in detail below with reference to the accompanying drawings and examples.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0028] The methods and embodiments provided in this application can be executed in a computer device or similar computing device. Taking running on a computer device as an example, Figure 1 This is a hardware structure block diagram of a computer device for a method of determining risk information according to an embodiment of this application. Figure 1 As shown, a computer device may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor (MPU) or a field-programmable gate array (FPGA)) and a memory 104 for storing data are also shown. The computer device may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that… Figure 1The shown structure is only a schematic, which does not limit the structure of the computer device. For example, the computer device can further include more or less components than those shown, or have a different configuration or arrangement of the components. Figure 1 The shown structure is only a schematic, which does not limit the structure of the computer device. For example, the computer device can further include more or less components than those shown, or have a different configuration or arrangement of the components. Figure 1 The shown structure is only a schematic, which does not limit the structure of the computer device. For example, the computer device can further include more or less components than those shown, or have a different configuration or arrangement of the components.

[0029] The memory 104 can be used to store computer programs, such as software programs of application software and modules, such as the computer program corresponding to the risk information determination method in the embodiments of the present application. The processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, that is, implements the above method. The memory 104 can include a high-speed random access memory, and can further include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory 104 can further include a memory remotely arranged with respect to the processor 102, which can be connected to the computer device through a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0030] The transmission device 106 is used to receive or send data via a network. The specific examples of the above network can include a wireless network provided by a communication provider of the computer device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC for short), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, RF for short) module, which is used to communicate with the Internet in a wireless manner.

[0031] In the embodiments of the present application, a risk information determination method is provided, which is applied to the above computer device, Figure 2 is a flowchart of the risk information determination method according to the embodiments of the present application, as shown in Figure 2 The flowchart includes the following steps:

[0032] In step S202, a target firmware of a target device is acquired, and the target firmware is decompressed according to a type of the target firmware, so as to acquire a file of the target firmware.

[0033] First, the firmware containing the running instructions and control logic is extracted. According to the type of the firmware (such as the compression format or the packaging manner), a corresponding decompression algorithm is used to unpack the compressed package of the firmware.

[0034] In step S204, a reverse operation is performed on the file, so as to acquire an operation process and an operation result corresponding to the reverse operation.

[0035] Reverse operation engineering is used to convert binary code back to a form close to the source code for understanding and analysis. In step S204, reverse operation includes but is not limited to disassembly and decompilation, thereby obtaining the detailed structure and logic of the firmware file.

[0036] In step S206, the first risk information of the target firmware is determined according to the operation result, and the file, the operation process and the operation result are input into the target model, so that the target model outputs the second risk information of the target firmware based on the file, the operation process and the operation result.

[0037] According to the result of the reverse operation in step S204, the first risk information of the firmware can be preliminarily determined based on known reverse technology and security rules. The file, operation process and operation result obtained in the reverse process are input as input into the pre-trained target model. The output of the model is the second risk information predicted based on big data and algorithm.

[0038] In step S208, the target risk information of the target firmware is determined according to the first risk information and the second risk information.

[0039] The first risk information and the second risk information obtained in step S206 are summarized and compared to determine the overall target risk information of the firmware.

[0040] Through the above steps, the target firmware of the target device is obtained, and the file of the target firmware is obtained according to the type of the target firmware; the reverse operation is performed on the file to obtain the operation process and the operation result corresponding to the reverse operation; the first risk information of the target firmware is determined according to the operation result, and the file, the operation process and the operation result are input into the target model, so that the target model outputs the second risk information of the target firmware based on the file, the operation process and the operation result; the target risk information of the target firmware is determined according to the first risk information and the second risk information. In the embodiment of the application, by combining the big model to make intelligent decisions and dynamically adjust in each link of firmware security analysis, the automation degree and vulnerability identification capability of firmware security analysis are greatly improved, the dependence on professional security analysis personnel is reduced, and the analysis efficiency is improved. Therefore, the problem of low efficiency of security analysis of firmware can be solved.

[0041] Further, the file of the target firmware is obtained by decompressing according to the type of the target firmware, including: determining whether there is a decompression failure problem in the decompression process; in the case that there is a decompression failure problem, inputting the decompression failure problem into the target model, so that the target model outputs a repair method corresponding to the decompression failure problem; adjusting the target firmware based on the repair method, and decompressing the adjusted target firmware to obtain the file of the target firmware.

[0042] In the embodiments of the present application, the type of the target firmware is identified and confirmed before decompression. By analyzing the firmware type, potential failure problems that may be encountered during the decompression process can be predicted, such as incompatible compression algorithm, file corruption, unknown encryption method, etc. If a failure is indeed encountered during the decompression process, the decompression failure problem is passed as input to the target model. The target model can be understood as a trained AI model. After obtaining the repair method, the target firmware is automatically or semi-automatically adjusted. This includes, but is not limited to, reformatting of the firmware file, correction of error data, or encryption and decryption operations. After the adjustment is completed, the target firmware is again attempted to be decompressed, and the process is repeated until the firmware file is successfully decompressed.

[0043] For example, when processing an IoT firmware of an unknown type, the firmware is first attempted to be decompressed according to the preliminary identified firmware type. During the decompression process, it is detected that there is a decompression failure problem, for example, some parts of the firmware cannot be correctly identified or decompressed. At this time, the detailed information of the decompression failure problem is input into the AI large model, and the AI large model outputs a repair method for the decompression failure problem after analysis, for example, it is suggested to use a specific decompression algorithm or adjust the decompression parameters. Based on the repair method output by the AI large model, the target firmware is adjusted accordingly, and then decompression operation is performed, and finally the file system and files of the firmware are successfully obtained.

[0044] The firmware decompression failure handling process in the embodiments of the present application not only reduces the need for manual intervention, but also improves the success rate and speed of firmware decompression. Through the AI model, when a decompression failure is encountered, the problem can be quickly identified and a repair method can be intelligently generated, achieving dynamic optimization of firmware decompression.

[0045] Further, after the target model outputs the risk information of the firmware based on the file and the operation result, the method further includes: determining whether to adjust the parameter information of the firmware based on the target model in a case where the risk information indicates that the firmware has a risk; performing a first operation strategy on the firmware in a case where it is determined to adjust the parameter information of the firmware based on the target model; and performing a second operation strategy on the firmware in a case where it is determined not to adjust the parameter information of the firmware based on the target model.

[0046] In the embodiments of the present application, the file obtained by reverse operation and its operation result are input into the target model for risk analysis. If the risk information shows that the firmware has a security risk, it is further determined whether the parameter information of the firmware should be adjusted based on the target model. If it is decided to adjust the parameter information of the firmware based on the target model, i.e., the first operation strategy is selected, the parameter information of the firmware is automatically or semi-automatically adjusted. For example, the security patch is updated, the configuration parameter is modified, the encryption measure is enhanced, and the like. On the contrary, if it is decided not to adjust the parameter information of the firmware based on the target model, i.e., the second operation strategy is selected, the second operation strategy includes but is not limited to manual review, expert intervention analysis, or processing based on a pre-set security strategy.

[0047] Optionally, the selection of the strategy can be flexibly adjusted according to the severity of the risk information, the characteristics of the firmware, and the security requirements of the IoT system. For example, for high-risk firmware, the first operation strategy can be preferentially selected for immediate intelligent adjustment; and for low-risk or special type of firmware, the second operation strategy can be adopted to avoid new problems or compatibility risks caused by unnecessary adjustment.

[0048] For example, in the case where the risk information indicates that the firmware has a risk, the AI large model intelligent unit analyzes the security risk of the firmware and gives a parameter adjustment suggestion based on the risk information. Assuming that in the reverse analysis unit, it is found by decompilation, disassembly and the like that there is a security vulnerability related to the configuration parameter in the firmware, and the risk information output by the target model analysis indicates that this vulnerability may cause the device to be remotely manipulated under a specific parameter setting. The user will be asked whether to adjust the parameter information of the firmware based on the suggestion of the target model to avoid this risk. If the user chooses to adjust, the first operation strategy is executed, such as automatically modifying the value of the specific parameter in the configuration file or generating a new configuration file version. If the user chooses not to adjust, the second operation strategy is executed, such as generating a detailed vulnerability report including the cause, type, impact range and suggested countermeasures of the vulnerability for the user to refer to.

[0049] In the embodiments of the present application, the corresponding strategy is automatically executed according to the user's selection, without the need for the user to manually write adjustment scripts or reports, thereby improving the automation degree and efficiency of firmware security analysis.

[0050] Further, the first operation strategy for the firmware includes adjusting the parameter information of the firmware based on the target model, obtaining the firmware after the adjustment of the parameter information and the file system after the adjustment of the parameter; loading the file system after the adjustment of the parameter to the simulation unit to generate a running environment of the firmware; and verifying the firmware after the adjustment of the parameter information based on the target verification program in the running environment to determine whether the firmware after the adjustment of the parameter information has a risk.

[0051] In the embodiments of the present application, when the risk information shows that the firmware has a problem, the parameters of the firmware are intelligently adjusted through a target model. Then, the file system after adjusting the parameters is imported into a simulation unit. The simulation unit is a virtual running environment that can simulate the running state of the firmware in the real IoT device without causing any impact or risk to the actual device. By loading the file system in the simulation unit, researchers can observe the behavior of the firmware in a safe and controllable environment. In the simulation environment, the firmware after adjusting the parameters is detected based on a specific target verification program. The target verification program is designed for known or assumed vulnerabilities, and the target verification program can trigger possible security problems in the firmware to verify whether the firmware after adjusting the parameters still has risks.

[0052] Finally, according to the verification result, it is determined whether the firmware after adjusting the parameters still has security risks. If the verification result shows that the security of the firmware has been improved, it can be considered that the first operation strategy is successful. Otherwise, if the firmware still has risks, the parameters need to be adjusted again, or other more effective security strategies need to be determined.

[0053] For example, performing the first operation strategy on a specific IoT firmware includes adjusting the parameter information of the firmware based on an AI large model, specifically adjusting the network communication port from 80 to 443, to obtain the firmware after adjusting the parameter information and the file system after adjusting the parameters; then loading the file system after adjusting the parameters into a simulation unit to generate a running environment of the firmware; verifying the firmware after adjusting the parameter information in the running environment based on a target verification program to determine whether the firmware after adjusting the parameter information has security risks, such as whether there is an unauthorized access vulnerability caused by port adjustment.

[0054] In the embodiments of the present application, by dynamically adjusting the parameter information and verifying in the simulation environment, the security performance of the firmware can be effectively verified and improved without damaging the device itself.

[0055] Further, adjusting the parameter information of the firmware based on the target model to obtain the firmware after adjusting the parameter information and the file system after adjusting the parameters includes: determining the business logic of the risk point of the firmware; controlling the target model to determine the repair method of the risk point according to the business logic of the risk point; adjusting the parameter information of the firmware according to the repair method to obtain the firmware after adjusting the parameter information and the file system after adjusting the parameters.

[0056] The business logic refers to the internal logic flow when the firmware performs a specific function. In the case where the risk point is determined, the risk point is analyzed by the target model, and a repair method is proposed. The repair method includes but is not limited to traditional patch updates, and can also involve parameter adjustment, code modification, and activation of dynamic defense mechanisms. According to the repair method proposed by the target model, the parameter information of the firmware is automatically adjusted. The adjusted firmware and file system are saved and subjected to subsequent verification and testing to confirm whether the repair measures are effective.

[0057] For example, in the process of analyzing the security of IoT firmware, the business logic of the risk point involving abnormal handling of network communication protocols is determined. According to the business logic of this risk point, the AI large model determines the repair method, i.e., adding a more stringent data verification mechanism in the abnormal handling of network communication protocols. Then, according to the repair method, the parameter information of the firmware is adjusted, specifically, a data verification configuration parameter is added in the network communication module of the firmware, to obtain the firmware after adjusting the parameter information and the file system after adjusting the parameter.

[0058] Further, the second operation strategy is performed on the firmware, including: obtaining the file system of the firmware, and loading the file system to the simulation unit to generate a running environment of the firmware, wherein the file system includes files; verifying the firmware based on the target verification program in the running environment, and determining again whether the firmware has risks.

[0059] The file system of the firmware is extracted, wherein the file system contains various files required for the running of the firmware, such as application programs, libraries, configuration files, etc. Then, the file system is loaded into the virtual environment of the simulation unit. In the simulation unit, a simulated environment similar to the actual running environment of the firmware is constructed according to the content of the file system. The construction process includes: setting the correct hardware architecture, operating system version, network conditions, etc., to ensure that the firmware can run in conditions close to the real world. Subsequently, the target verification program is run in the constructed running environment. The target verification program triggers possible security problems in the firmware by simulating attacks or abnormal inputs, etc., to verify the real security status of the firmware. Through the test results of the verification program, the security risks of the firmware are evaluated again.

[0060] The evaluation by the verification program in the embodiments of the present application is in a dynamic running environment, which can more comprehensively understand the potential weaknesses of the firmware compared to static analysis (such as reverse engineering). If the verification result shows that the firmware still has security problems, further analysis and repair may be needed. On the other hand, if the verification is successful, i.e., the firmware does not exhibit any risks in the running environment, it can be considered that the current firmware version is safe under the known test conditions.

[0061] For example, an IoT firmware named Firmware_A is acquired, and the firmware acquisition unit combines the AI large model to accurately identify Firmware_A as a Linux system firmware based on ARM architecture. Subsequently, the firmware unpacking unit decompresses and extracts the file system of Firmware_A to obtain a series of files. Next, these files are loaded into the simulation unit to generate a simulation environment similar to the actual running environment of Firmware_A. In this simulation environment, the target verification program generated based on the AI large model verifies Firmware_A to determine whether Firmware_A has security risks again.

[0062] Further, before determining whether to adjust the parameter information of the firmware based on the target model, the method further comprises: determining the risk type and business logic of the firmware, and generating a verification program according to the risk type and business logic; inputting the verification program into the target model to make the target model check the verification program; in the case that the target model determines that the verification program has an exception, repairing the verification program through the target model to obtain a target verification program.

[0063] Determine the risk type existing in the firmware, such as buffer overflow, SQL injection, privilege escalation and other common security vulnerabilities, and the business logic associated with these risks. Based on the risk type and business logic of the firmware, generate a corresponding verification program. The verification program is used to simulate potential attack or vulnerability triggering scenarios to verify whether the firmware behaves unexpectedly or has security vulnerabilities under certain conditions. The generated verification program will be input into the target model for checking. If the target model finds an exception when analyzing the verification program, whether it is a logical error, a code flaw or an improper way of interacting with the firmware, a repair measure will be taken. Repair measures include but are not limited to rewriting, logic adjustment or parameter modification of the verification program to eliminate detected exceptions and improve the reliability and effectiveness of the verification program.

[0064] For example, suppose a smart camera firmware is analyzed. Before starting to adjust the firmware parameter information based on the AI large model, first use the AI large model to analyze the risk type and business logic of the firmware. The analysis result shows that the firmware may have a buffer overflow risk, and the business logic contains a network communication function. According to this information, a verification program for buffer overflow is generated, including trying to send an abnormal data packet containing a specific pattern to the device. This verification program is input into the AI large model, and the AI large model analyzes the correctness and efficiency of the verification program. In the analysis, the AI large model finds that some parameter settings of the verification program are improper, which may cause false positives or false negatives. Therefore, the AI large model automatically adjusts the parameters in the verification program, such as changing the size and structure of the abnormal data packet, to more accurately trigger the potential buffer overflow vulnerability.

[0065] Through the embodiments of the present application, not only a high-quality verification program can be generated, but also the verification program can accurately reflect the security status of the firmware, thereby providing a solid foundation for subsequent parameter adjustment strategies based on the verification results.

[0066] In order to better understand the process of the above risk information determination method, the implementation method flow of the determination of the above risk information will be described in combination with the optional embodiments below, but not used to limit the technical solutions of the embodiments of the present application.

[0067] In the present embodiment, a risk information determination system is provided, Figure 3 is a structural block diagram of the risk information determination system of the embodiments of the present application, and the risk information determination system is composed of a firmware acquisition unit, a firmware unpacking unit, a reverse analysis unit, a verification program unit, an AI large model intelligent unit, a display unit and a strategy unit. Specifically as follows:

[0068] The firmware acquisition unit is used to acquire the IoT firmware, and the acquisition of the IoT firmware can be achieved by online downloading or directly extracting from the IoT device. After acquiring the firmware, the unit will perform preliminary firmware type identification to determine which architecture or system type the firmware belongs to, and then upload the identification result and the firmware itself to the AI large model intelligent unit for more accurate secondary type identification and confirmation.

[0069] The firmware unpacking unit is used to unpack and extract the IoT firmware based on the result of the firmware type identification, and the unpacking and extraction of the IoT firmware includes but is not limited to operations such as decompressing the firmware package and extracting the file system, so as to obtain the file system that can be used for subsequent analysis. The unpacking unit will record and feedback the information in the decompression and extraction process in real time, and these information will be synchronized to the AI large model intelligent unit for intelligent processing of possible problems encountered in the decompression and extraction process.

[0070] The reverse analysis unit is used to analyze the decompressed and extracted file system and files in depth, including: decompilation, disassembly and control flow analysis to identify potential security risks and vulnerabilities. The reverse analysis unit synchronizes the operation steps, inputs and outputs of the reverse analysis to the AI large model intelligent unit in real time, uses the intelligent analysis capability of AI to effectively identify risks / vulnerabilities and their causes, and outputs possible code-level repair solutions.

[0071] The verification program unit is used to generate a vulnerability verification program (Proof of Concept, POC) after the reverse analysis unit and the AI large model intelligent unit identify security risks or vulnerabilities. The POC program is input into the AI large model intelligent unit for intelligent debugging and verification to confirm its effectiveness and accuracy. With the assistance of the AI unit, the verification program unit forms the final verification program and feeds it back to itself for subsequent use.

[0072] The simulation unit is used to receive the extracted file system and build a real IoT firmware running environment that simulates the running state of the firmware on the actual device, providing a necessary platform for subsequent vulnerability verification and security analysis.

[0073] The AI large model intelligent unit is closely integrated with each functional unit to provide intelligent decision-making and problem-solving. The AI large model intelligent unit not only assists in firmware type identification and problem-solving during unpacking, but also deeply participates in the processes of reverse analysis, verification program generation, and simulation environment construction, ensuring the intelligence and efficiency of the entire process.

[0074] The strategy unit allows users to customize IoT firmware processing strategies, including but not limited to: process selection, problem-solving scheme selection, verification program optimization integration, whether to perform model parameter tuning, tuning dimension, and intelligent processing depth and dimension settings, providing users with flexible control means.

[0075] The display unit is used to display the data and information of the entire IoT firmware processing process, including the input, output, and processing process of each unit, and provides a selection interface for strategies and parameters, allowing users to intuitively monitor the entire process and intervene as necessary.

[0076] A risk information determination method is provided in the embodiment, Figure 4 is a flowchart of the risk information determination method according to the embodiment of the present application (two), as Figure 4 shown, the specific steps are as follows:

[0077] Step S401: Obtain IoT firmware and accurately identify the type of IoT firmware in combination with an AI large model.

[0078] Obtain Internet of Things (IoT) firmware, and after obtaining, identify the type of firmware by combining pre-defined rules and intelligent analysis capabilities of an artificial intelligence large model.

[0079] Step S402: Extract the file system of the IoT firmware in combination with an AI large model.

[0080] Combined with the AI large model intelligent unit, the dedicated decompression tool matching the IoT firmware type is used to accurately decompress the firmware package and extract the file system and related files therefrom.

[0081] Based on the AI large model, the deep recognition has more accurate and efficient firmware type recognition ability than the traditional single firmware recognition tool, and can analyze and judge the firmware type recognition process in real time, has heterogeneous firmware type recognition ability and firmware type judgment analysis ability, and can also provide comprehensive analysis and judgment process for security personnel.

[0082] Based on the AI large model, the firmware unpacking can quickly and effectively identify the firmware type in a highly heterogeneous firmware scenario and perform targeted and rapid unpacking. Compared with the traditional method of finding and matching unpacking tools with firmware, it not only eliminates the need for manual preparation and matching of unpacking tools, but also dynamically adjusts the unpacking method and strategy in real time according to the feedback during the unpacking process, greatly improving the success rate and efficiency of firmware unpacking.

[0083] Step S403: Perform deep reverse analysis on the extracted file system using the AI large model, comprehensively analyze the firmware application code and assembly machine instructions, and perform mutual verification to accurately identify security vulnerabilities and various parameter configuration information, and provide repair code / parameters.

[0084] Step S403: Perform deep reverse analysis on the extracted file system and files using the AI large model, including but not limited to decompilation, disassembly, and control flow analysis. The analysis results are verified by mutual verification of conventional detection tools and the AI large model to ensure accurate identification of security vulnerabilities. In addition, the AI large model will also propose repair code or parameter suggestions and collect parameter configuration information of the file system.

[0085] Step S404: Based on the reverse analysis data and identified security vulnerabilities, use the AI large model to generate a verifiable vulnerability verification program.

[0086] Based on the reverse analysis data and security vulnerability results of step S403, step S404 uses the AI large model to intelligently generate a vulnerability verification program (Proof of Concept, abbreviated as POC). The POC program will be customized according to the code logic and business functions of the identified vulnerability points to ensure that it can accurately trigger and verify the effectiveness of these security vulnerabilities.

[0087] Based on the real-time and automatic reverse analysis capability of the AI large model, the IoT firmware file system and files are reversely analyzed from multiple dimensions such as application code, assembly machine instructions, and control flow analysis, to comprehensively demonstrate and identify the security vulnerabilities existing in the IoT firmware. Compared with the traditional firmware security detection analysis based on predefined detection rules, the security vulnerability detection of the present scheme has more dimensions, wider detection face, more flexible detection mechanism, and more accurate detection results, especially for unknown vulnerabilities.

[0088] Step S405: Determine whether to adjust the parameters of the IoT file system and files.

[0089] In step S405, the user is allowed to decide whether to adjust the parameters of the IoT firmware and file system. Considering that the diversity of parameter configuration will affect the security evaluation results of the firmware, this decision gives the user the option to adjust the parameters in an AI model or custom manner.

[0090] Step S406: When the parameters are not adjusted, the extracted file system is imported for simulation to generate a real IoT running environment.

[0091] When it is decided not to adjust the parameters, the extracted file system is imported into the simulation unit to build the running environment of the IoT firmware.

[0092] Step S407: In the IoT simulation environment, use the vulnerability verification program based on the vulnerabilities analyzed from the IoT firmware to verify the IoT firmware, and continuously optimize the vulnerability verification program.

[0093] In the simulation environment, the firmware is verified in real time using the vulnerability verification program generated based on the reverse analysis results. This process verifies the authenticity of the vulnerabilities and continuously optimizes the verification program through the AI large model to achieve the best verification effect.

[0094] Step S408: When the parameters are adjusted, the user can customize or the AI large model can adaptively adjust the parameters of the IoT file system or files based on the identified vulnerability codes or various parameter configurations.

[0095] The AI model or user-defined parameter adjustment mechanism is used to modify the parameters in the file system.

[0096] Step S409: Import the parameter-adjusted file system into the simulation unit for environment simulation, continuously carry out environment simulation, vulnerability verification program generation, and vulnerability verification, and obtain various vulnerability information, vulnerability verification programs, and vulnerability repair schemes.

[0097] The adjusted file system is imported into the simulation unit again for a cycle of environment reconstruction, POC program generation, and vulnerability verification until a conclusion is reached.

[0098] Step S410: output the IoT firmware analysis process and results, and integrate the vulnerability verification program and vulnerability repair scheme to form a vulnerability knowledge base.

[0099] The system outputs the complete analysis process and results of the IoT firmware, including but not limited to the identified security vulnerabilities, security evaluation under different parameter configurations, and specific vulnerability repair suggestions.

[0100] In the embodiments of the present application, automation is realized in the whole process of closed loop from firmware identification, extraction, reverse analysis, vulnerability identification, generation of verification program, simulation of environment and verification of vulnerability. Each link is automatically carried out, and the AI large model makes real-time intelligent decisions, adjustments and disposals for problems occurring in the process. Compared with the traditional firmware security analysis, the present scheme automatically connects and triggers each link, without the need for manual intervention in the connection of links and the disposal of problems in the process.

[0101] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be realized by means of software and the necessary general hardware platform, of course, it can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes a plurality of instructions for causing a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the embodiments of the present application.

[0102] In the present embodiment, a risk information determination apparatus is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and will not be described again. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware or a combination of software and hardware is also possible and is contemplated.

[0103] Figure 5 is a structural block diagram of the risk information determination apparatus according to the embodiments of the present application, as shown in Figure 5 The apparatus comprises:

[0104] The decompression module 52 is configured to obtain a target firmware of a target device, and decompress the target firmware according to the type of the target firmware to obtain a file of the target firmware.

[0105] The operation module 54 is configured to perform reverse operation on the file to obtain an operation process and an operation result corresponding to the reverse operation.

[0106] The first determination module 56 is configured to determine first risk information of the target firmware according to the operation result, and input the file, the operation process and the operation result into a target model, so that the target model outputs second risk information of the target firmware based on the file, the operation process and the operation result.

[0107] The second determination module 58 is configured to determine target risk information of the target firmware according to the first risk information and the second risk information.

[0108] Through the above device, the target firmware of the target device is obtained, and the target firmware is decompressed according to the type of the target firmware to obtain a file of the target firmware; the file is reversely operated to obtain an operation process and an operation result corresponding to the reverse operation; first risk information of the target firmware is determined according to the operation result, and the file, the operation process and the operation result are input into a target model, so that the target model outputs second risk information of the target firmware based on the file, the operation process and the operation result; and target risk information of the target firmware is determined according to the first risk information and the second risk information. In the embodiment of the application, intelligent decision and dynamic adjustment are made in each link of firmware security analysis by combining a large model, which greatly improves the automation degree and vulnerability identification capability of firmware security analysis, reduces the dependence on professional security analysts, and improves the analysis efficiency. Therefore, the problem of low efficiency of security analysis on firmware can be solved.

[0109] Further, the decompression module is configured to determine whether there is a decompression failure problem in the decompression process; in the case that there is a decompression failure problem, input the decompression failure problem into the target model, so that the target model outputs a repair method corresponding to the decompression failure problem; adjust the target firmware based on the repair method, and decompress the adjusted target firmware to obtain the file of the target firmware.

[0110] Further, the above device further includes a strategy module configured to, in the case that the risk information indicates that the firmware has a risk, determine whether to adjust parameter information of the firmware based on the target model; in the case that it is determined to adjust the parameter information of the firmware based on the target model, execute a first operation strategy on the firmware; and in the case that it is determined not to adjust the parameter information of the firmware based on the target model, execute a second operation strategy on the firmware.

[0111] Further, the strategy module is configured to adjust the parameter information of the firmware based on the target model, obtain the firmware after the adjustment of the parameter information and a file system after the adjustment of the parameters; load the file system after the adjustment of the parameters to the simulation unit to generate a running environment of the firmware; and verify the firmware after the adjustment of the parameter information based on a target verification program in the running environment to determine whether the firmware after the adjustment of the parameter information has a risk.

[0112] Further, the strategy module is configured to determine the business logic of the risk point of the firmware, and control the target model to determine the repair method of the risk point according to the business logic of the risk point, and adjust the parameter information of the firmware according to the repair method, and obtain the firmware after the adjustment of the parameter information and the file system after the adjustment of the parameter.

[0113] Further, the strategy module is configured to obtain the file system of the firmware, and load the file system to the simulation unit to generate a running environment of the firmware, wherein the file system comprises files, and verify the firmware based on the target verification program in the running environment, and determine whether the firmware has the risk again.

[0114] Further, the first determination module is configured to determine the risk type and the business logic of the firmware, and generate the verification program according to the risk type and the business logic, input the verification program into the target model to make the target model check the verification program, and when the target model determines that the verification program has an exception, repair the verification program through the target model to obtain the target verification program.

[0115] It should be noted that the above modules can be implemented by software or hardware, and for the latter, the following implementation manners can be used, but are not limited thereto: the above modules are located in the same processor; or the above modules are located in different processors in any combination.

[0116] Embodiments of the present application also provide a computer readable storage medium, which stores a computer program, wherein the computer program is configured to execute the steps in any of the above method embodiments when running.

[0117] Optionally, in the present embodiment, the above storage medium can be configured to store program codes for executing the following steps:

[0118] S1, obtaining a target firmware of a target device, and decompressing the target firmware according to the type of the target firmware to obtain files of the target firmware;

[0119] S2, performing reverse operations on the files to obtain operation processes and operation results corresponding to the reverse operations;

[0120] S3, determining first risk information of the target firmware according to the operation results, and inputting the files, the operation processes and the operation results into a target model to make the target model output second risk information of the target firmware based on the files, the operation processes and the operation results;

[0121] S4, determining target risk information of the target firmware according to the first risk information and the second risk information.

[0122] In an example embodiment, the computer readable storage medium described above can include, but is not limited to, a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store computer programs.

[0123] Embodiments of the present application also provide an electronic device including a memory and a processor, the memory storing a computer program, and the processor being configured to execute the computer program to perform the steps in any of the method embodiments described above.

[0124] In an example embodiment, the electronic device described above can further include a transmission device connected to the processor and an input and output device connected to the processor.

[0125] Optionally, in the present embodiment, the processor can be configured to perform the following steps by the computer program:

[0126] S1, obtaining a target firmware of a target device, and decompressing the target firmware according to a type of the target firmware to obtain a file of the target firmware;

[0127] S2, performing a reverse operation on the file to obtain an operation process and an operation result corresponding to the reverse operation;

[0128] S3, determining first risk information of the target firmware according to the operation result, and inputting the file, the operation process and the operation result into a target model to make the target model output second risk information of the target firmware based on the file, the operation process and the operation result;

[0129] S4, determining target risk information of the target firmware according to the first risk information and the second risk information.

[0130] Embodiments of the present application also provide a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the steps in any of the method embodiments described above.

[0131] Embodiments of the present application also provide another computer program product, which includes a non-volatile computer readable storage medium storing a computer program, and the computer program is executed by a processor to implement the steps in any of the method embodiments described above.

[0132] The embodiment of the present application further provides a computer program, which comprises computer instructions stored in a computer readable storage medium; a processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device executes the steps in any one of the method embodiments.

[0133] Optionally, in the embodiment, the processor can be configured to execute the following steps by using the computer program:

[0134] S1, obtaining a target firmware of a target device, and decompressing the target firmware according to a type of the target firmware to obtain a file of the target firmware;

[0135] S2, performing a reverse operation on the file to obtain an operation process and an operation result corresponding to the reverse operation;

[0136] S3, determining first risk information of the target firmware according to the operation result, and inputting the file, the operation process and the operation result into a target model, so that the target model outputs second risk information of the target firmware based on the file, the operation process and the operation result;

[0137] S4, determining target risk information of the target firmware according to the first risk information and the second risk information.

[0138] The specific examples in the embodiment can refer to the examples described in the above embodiments and exemplary embodiments, and the embodiment will not be described here.

[0139] Obviously, those skilled in the art should understand that each module or each step of the present application described above can be realized by using a general computing device, which can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, which can be realized by using program codes executable by a computing device, so that they can be stored in a storage device and executed by a computing device, and in some cases, the steps shown or described can be executed in different order, or they can be manufactured into each integrated circuit module, or multiple modules or steps can be manufactured into a single integrated circuit module. Thus, the present application is not limited to any specific combination of hardware and software.

[0140] The above only describes the preferred embodiments of the present application and is not used to limit the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method of determining risk information, characterized by, The method comprises the following steps: obtaining a target firmware of a target device, and decompressing the target firmware according to a type of the target firmware to obtain a file of the target firmware; performing reverse operations on the file to obtain an operation process and an operation result corresponding to the reverse operations; determining first risk information of the target firmware according to the operation result, and inputting the file, the operation process and the operation result into a target model to enable the target model to output second risk information of the target firmware based on the file, the operation process and the operation result; determining target risk information of the target firmware according to the first risk information and the second risk information.

2. The method of claim 1, wherein, The decompression of the target firmware according to the type of the target firmware to obtain the file of the target firmware comprises the following steps: determining whether there is a decompression failure problem in the process of decompressing the target firmware according to the type of the target firmware; in the case where there is a decompression failure problem, inputting the decompression failure problem into a target model to enable the target model to output a repair method corresponding to the decompression failure problem; adjusting the target firmware based on the repair method, and decompressing the adjusted target firmware to obtain the file of the target firmware.

3. The method of claim 1, wherein, After the file and the operation result are input into the target model to enable the target model to output the risk information of the firmware based on the file and the operation result, the method further comprises the following steps: in the case where the risk information indicates that the firmware has a risk, determining whether to adjust parameter information of the firmware based on the target model; in the case where it is determined to adjust the parameter information of the firmware based on the target model, performing a first operation strategy on the firmware; in the case where it is determined not to adjust the parameter information of the firmware based on the target model, performing a second operation strategy on the firmware.

4. The method of claim 3, wherein, The first operation strategy performed on the firmware comprises the following steps: adjusting the parameter information of the firmware based on the target model to obtain the firmware after the adjustment of the parameter information and a file system after the adjustment of the parameters; loading the file system after the adjustment of the parameters into an emulation unit to generate a running environment of the firmware; verifying the firmware after the adjustment of the parameter information based on a target verification program in the running environment to determine whether the firmware after the adjustment of the parameter information has a risk.

5. The method of claim 4, wherein, The adjustment of the parameter information of the firmware based on the target model to obtain the firmware after the adjustment of the parameter information and the file system after the adjustment of the parameters comprises the following steps: determining a business logic of a risk point of the firmware; controlling the target model to determine a repair method of the risk point according to the business logic of the risk point; adjusting the parameter information of the firmware according to the repair method to obtain the firmware after the adjustment of the parameter information and the file system after the adjustment of the parameters.

6. The method of claim 3, wherein, The second operation strategy performed on the firmware comprises the following steps: obtaining a file system of the firmware, and loading the file system into an emulation unit to generate a running environment of the firmware, wherein the file system comprises the file; The firmware is verified based on a target verification program in the running environment to determine again whether the firmware is at risk.

7. The method of claim 3, wherein, Before determining whether to adjust parameter information of the firmware based on the target model, the method further comprises: determining a risk type and business logic of the firmware, and generating a verification program according to the risk type and the business logic; inputting the verification program into the target model to enable the target model to check the verification program; in a case where the target model determines that the verification program is abnormal, repairing the verification program through the target model to obtain a target verification program.

8. A risk information determining apparatus characterized by comprising: comprises: a decompression module configured to obtain target firmware of a target device, and decompress the target firmware according to a type of the target firmware to obtain a file of the target firmware; an operation module configured to perform reverse operation on the file to obtain an operation process and an operation result corresponding to the reverse operation; a first determination module configured to determine first risk information of the target firmware according to the operation result, and input the file, the operation process and the operation result into a target model to enable the target model to output second risk information of the target firmware based on the file, the operation process and the operation result; a second determination module configured to determine target risk information of the target firmware according to the first risk information and the second risk information.

9. A computer readable storage medium, characterized in that, The computer-readable storage medium comprises a stored program, wherein the program executes the method of any one of claims 1 to 7 when running.

10. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to execute the method of any one of claims 1 to 7 through the computer program.

Images